After a caught native fault the app keeps using the damaged engine - #168
Merged
Conversation
coffeecatch recovers a SIGSEGV with siglongjmp, which unwinds nothing: hts_init() ran, hts_uninit() never will, and the cache file, the sockets and any lock the faulting frame held stay as the fault left them. We reported the fault and carried on using that engine. Latch the fault where it is caught, and refuse every entry point that reaches the engine from then on. stop(), abortCode(), wasStopped() and free() refuse without taking the engine lock, which the faulting frame may still hold, and without throwing into a click handler; buildTopIndex() refuses without throwing, since its callers dump what they catch over the dump describing the fault. The crawl is refused before it starts, the error panel says so, and leaving that panel ends the process, so the next mirror runs on a fresh one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
It runs from the Runner's field initializer, so an exception there takes the activity down before the crawl that faulted ever reports it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
Android hands a relaunch whatever process it kept, latch and all, which would leave the engine refused with nothing on screen to explain it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
Neither catch tolerates a fault to spare the process any more. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
Review found the exit lost data: finish() only schedules the destroy, so System.exit(0) on the next line beat onDestroy() and its serialize(). The two new call sites now finish() and let onDestroy() end the process once it has saved. The root-deleted path had the same shape and is folded into the same flag. COFFEE_CATCH also runs when coffeecatch_setup() fails, with no signal delivered and the engine intact, so the latch now asks for the signal. stop() threw "null context" without returning, then dereferenced it. The decisions the activity makes move into NativeFaultPolicy, where a truth table can reach them: the source-text tests could only see the vocabulary of a guard, so an inverted test, a missing return or a commented-out latch all passed. Tests now read the C with comments and literals blanked, and the brace scanner is shared rather than a third copy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
Folding it into the deferred exit let onDestroy() serialize on the way out, and that mkdirs the project and cache directories the user had just deleted. It has to end the process itself, so a test now says so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A recovered native fault is a
siglongjmp: nothing unwinds. The engine's process-wide mutexes and the heap stay as the faulting frame left them, and the lock the crawl held is never released. We reported the fault and went on using that engine.The fault is now latched where it is caught, and every entry point back into the engine refuses from then on. The ones that cannot throw refuse quietly and without taking that lock:
stop()(click handler),free()(finalizer) andinit()(constructor). A crawl is refused before it starts, the panel says why, and the process ends when the activity finishes, afteronDestroy()has saved the profile.NativeFaultPolicyholds the three decisions this puts on the UI, so a truth table can reach them without a device. One pre-existing bug came along:stop()threw "null context" without returning, then dereferenced it on the next line.Closes #161